CVE-2026-90161

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The malformed bytes are on-disk in z_erofs_map_header.h_advise (Z_EROFS_ADVISE_INTERLACED_PCLUSTER|Z_EROFS_ADVISE_INLINE_PCLUSTER) and a PLAIN tail lcluster; z_erofs_read_folio/z_erofs_readahead pass them into z_erofs_map_blocks_fo when that compressed file's tail is read. No network protocol message carries those fields.

AC:LAttack complexity, low

Setting both advise flags plus z_idata_size on a compressed inode with a PLAIN EOF lcluster makes z_erofs_map_blocks_fo assign Z_EROFS_COMPRESSION_INTERLACED despite EROFS_MAP_META; the following read of that tail reaches z_erofs_transform_plain every time, with no race or attacker-uncontrolled condition.

PR:NPrivileges required, none

Crafting and supplying the interlaced+ztailpacking image requires no account on the target. erofs_fs_type has FS_REQUIRES_DEV and lacks FS_USERNS_MOUNT, so the attacker cannot self-mount in a userns; the CAP_SYS_ADMIN mount is the victim's action and is scored as UI:R.

UI:RUser interaction, required

A victim or automounter must mount the attacker-supplied EROFS image and read the compressed file so z_erofs_read_folio maps the ztailpacking pcluster. erofs_read_superblock and erofs_fill_inode do not call z_erofs_map_blocks_fo for that tail.

S:UScope, unchanged

The over-read in z_erofs_transform_plain and the memcpy_to_page into the file folio stay inside the host kernel; this does not cross a KVM/Xen, IOMMU, or sandbox authority.

C:HConfidentiality impact, high

z_erofs_transform_plain kmaps the inline-metadata page and copies cur bytes from kin+pi into the output folio via memcpy_to_page. Unaligned ztailpacking pageofs_in (map->m_pa & ~PAGE_MASK) makes pi+cur run off that page, so up to a block of adjacent kernel memory becomes readable through the file.

I:NIntegrity impact, none

The write lands in rq->out[0] at pageofs_out for length cur=min(bs-(pageofs_out&(bs-1)),outputsize), which stays inside the first output folio. The defect is an input-side over-read, not an OOB write or corruption of kernel control data.

A:HAvailability impact, high

The kmap_local_page over-read in the interlaced branch of z_erofs_transform_plain can fault when the next virtual page is unmapped (HIGHMEM kmap slots, debug_pagealloc, KASAN), oopsing the kernel, and reading the crafted tail again retriggers it.